Vulnerabilities

Skype for Business Has a 9.8 RCE. No Login Required

September 9, 2026September 9, 2026

3 mins

The Mess: Microsoft patched CVE-2026-66302, a critical remote-code-execution flaw in Skype for Business Server. The bug scores 9.8 and requires no authentication or user interaction.
The Damage: A network attacker can potentially execute arbitrary code on a vulnerable Skype for Business server.
The Fix: Patch affected servers immediately and restrict Skype for Business infrastructure to trusted network paths.

Skype for Business is old enterprise plumbing.

That does not make it harmless.

CVE-2026-66302 is a critical remote-code-execution vulnerability caused by external control of a file name or path, classified as CWE-73. Microsoft’s CVSS 3.1 score is 9.8 Critical with AV:N/AC:L/PR:N/UI:N.

Translation:

Network access.
Low complexity.
No credentials.
No user interaction.

The affected products include Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU8 and Skype for Business Server Subscription Edition CU1. Microsoft provides patched versions for each affected branch.

The vulnerability is particularly interesting because the flaw is not described as a classic memory-corruption bug.

It is a path/file-name control problem.

That means attacker-controlled data can influence where the server expects files or how it processes file paths. Under the right conditions, that crosses the line from input manipulation into arbitrary code execution.

And the CVSS vector makes the intended threat model obvious.

The attacker does not need an account on the Skype server. There is no phishing step. There is no malicious attachment that an employee has to open.

The server is the target.

CISA’s vulnerability enrichment currently marks exploitation as none, but also classifies the issue as automatable with total technical impact.

That is the distinction worth keeping.

This is not currently an exploited zero-day.

It is a critical pre-auth RCE sitting in enterprise communications infrastructure.

Skype for Business deployments also tend to be long-lived. Some organizations keep them running because replacing an internal communications platform is expensive, disruptive and politically unpopular.

Attackers do not care about the migration roadmap.

If the server is vulnerable and reachable, it is part of the attack surface.

Administrators should identify every Skype for Business Server deployment, verify the installed cumulative update level and apply Microsoft’s September 2026 security fixes.

Then review exposure.

A communications server should not be casually reachable from the public Internet. Segment it, restrict access to required networks and monitor unusual connections to the service.

Bugstoday Opinion

Skype for Business looks like yesterday’s technology.

That is precisely why nobody should assume it is yesterday’s security problem.

A 9.8 unauthenticated RCE in a legacy enterprise communications platform is an attractive target because these systems tend to survive long after their original deployment assumptions have disappeared.

Patch it.

Restrict it.

And if nobody can explain why that Skype server still exists, maybe that is the bigger problem.

Today’s Bugs. Tomorrow’s Breaches.